# This script was written by Michel Arboi # # GNU Public Licence # # References: # # Date: Sun, 10 Mar 2002 21:37:33 +0100 # From: "Obscure" # To: bugtraqat_private, vulnwatchat_private # Subject: IMail Account hijack through the Web Interface if(description) { script_id(11271); script_version("$Revision$"); name["english"] = "IMail account hijack"; script_name(english:name["english"]); desc["english"] = " The remote host is running IMail web interface. In this version, the session is maintained via the URL. It will be disclosed in the Referer field if you receive an email with external links (e.g. images) Solution : Upgrade to IMail 7.06 or newer Risk factor : Medium"; script_description(english:desc["english"]); summary["english"] = "Checks for version of IMail web interface"; summary["francais"] = "Vérifie la version de l'interface web de IMail"; script_summary(english:summary["english"], francais:summary["francais"]); script_category(ACT_GATHER_INFO); script_copyright(english:"Copyright (C) 2003 Michel Arboi"); family["english"] = "CGI abuses"; family["francais"] = "Abus de CGI"; script_family(english:family["english"], francais:family["francais"]); script_dependencie("find_service.nes", "no404.nasl", "http_version.nasl"); #script_require_keys("www/IMail"); script_require_ports("Services/www", 80); exit(0); } # The script code starts here include ("http_func.inc"); port = get_kb_item("Services/www"); if (! port) port = 80; if (! get_port_state(port)) exit(0); banner = get_http_banner(port: port); serv = egrep(string: banner, pattern: "^Server:.*"); if(ereg(pattern:"^Server:.*Ipswitch-IMail/(([1-6]\.)|(7\.0[0-5]))", string:serv)) security_warning(port);